chore(ci): always build tutorial agents with --no-cache

Force --no-cache on every build in the publish workflow (both the ':latest'
push path and SHA-tagged validation builds), not just the mutable-tag path.
Simpler and removes any chance of a stale cached layer shipping outdated
source; costs only a few minutes of build time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: deepthi-rao-scale

.github/workflows/build-and-push-tutorial-agent.yml

@@ -185,24 +185,21 @@ jobs:
           if [ "${{ github.event_name }}" = "push" ] || [ "${{ inputs.rebuild_all }}" = "true" ]; then
             SHOULD_PUSH=true
             VERSION_TAG="latest"
-            # ':latest' is a moving tag, so build without cache: a stale cached layer
-            # must never silently ship source that differs from the checkout.
-            CACHE_FLAG="--no-cache"
             echo "🚀 Building agent (will push after validation): ${{ matrix.agent_path }}"
           else
             SHOULD_PUSH=false
             VERSION_TAG="${{ github.sha }}"
-            # SHA-tagged validation build is immutable, so the cache is safe (and faster).
-            CACHE_FLAG="--cache"
             echo "🔍 Building agent for validation: ${{ matrix.agent_path }}"
             # Set full image name for validation step (local build)
             echo "FULL_IMAGE=${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}" >> $GITHUB_ENV
             # Skip image validation for PRs since Buildx doesn't load multi-platform images locally
             echo "SKIP_VALIDATION=true" >> $GITHUB_ENV
           fi
 
-          # Always build locally first (without push)
-          BUILD_ARGS="--manifest ${{ matrix.agent_path }}/manifest.yaml --registry ${REGISTRY} --tag ${VERSION_TAG} --platforms linux/amd64,linux/arm64 --repository-name ${REPOSITORY_NAME} ${CACHE_FLAG}"
+          # Always build without cache: a stale cached layer must never silently ship
+          # source that differs from the checkout (this is how a merged fix once failed
+          # to reach ':latest'). Correctness over a few minutes of build time.
+          BUILD_ARGS="--manifest ${{ matrix.agent_path }}/manifest.yaml --registry ${REGISTRY} --tag ${VERSION_TAG} --platforms linux/amd64,linux/arm64 --repository-name ${REPOSITORY_NAME} --no-cache"
 
           agentex agents build $BUILD_ARGS
           echo "✅ Successfully built: ${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}"